CMMC Domain IA Identification and Authentication
Closely tied to Access Control, this Domain contains practices to ensure that only the person assigned to a user account is the one using it.
- Identification: Identify system users, processes acting on behalf of users, and devices.
- Identifier Handling: Disable identifiers after a defined period of inactivity.
- Multifactor Authentication: Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts.
- Identifier Reuse: Prevent reuse of identifiers for a defined period.
- Authentication: Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems.
- Password Complexity: Enforce a minimum password complexity and change of characters when new passwords are created.
- Obscure Feedback: Obscure feedback of authentication information.
- Temporary Passwords: Allow temporary password use for system logons with an immediate change to a permanent password.
- Replay-Resistant Authentication: Employ replay-resistant authentication mechanisms for network access to privileged and non-privileged accounts.
- Password Reuse: Prohibit password reuse for a specified number of generations.
- Cryptographically-Protected Passwords: Store and transmit only cryptographically-protected passwords.